Despite what the delightful narrator from Fallout has to say on the subject, war is indeed changing. Incursions into the territory of a sovereign state no longer necessitate the use of spies and armies; technology has taken the mantle, leaving behind traces of code in the places formerly occupied by whispers and manila envelopes. The sneakiest weapon in this new kind of war is the data-stealing virus, and the world's all up in arms about one in particular this week: Flame.

Flame is a nasty piece of work. After infiltrating a machine - which it can do by masquerading as a Windows Update packet or via other means - Flame has the capacity to raid the infected machine for data, keystrokes, and audio files. It takes screenshots every 60 seconds when the computer is running normally, or one every 15 seconds when the user has Outlook, email, or an instant messenging service open. It can infect microphones, collecting audio data from Skype calls and other computer-based chat services. It can even turn Bluetooth-enabled machines into beacons, using this platform to collect contact information from other Bluetooth devices in the vicinity.

All of this gathered information is stored by the virus and then sent off to the attackers' command-and-control servers for, one presumes, human investigation.

I know, right? Pretty serious stuff. So far as cybersecurity experts at Kaspersky Lab have been able to determine, Flame has been used primarily to infect computers in Iran, the Israeli Occupied Territories, Sudan, and Syria. Customers of cybersecurity firm Symantec have reported instances of Flame from Hungary to the United Arab Emirates, maintaining the malware's focus on Middle Eastern devices.

These facts, coupled with Flame's incredible scope and complexity, have led researchers to conclude that the virus is part of a state-run cyberwarfare operation, something akin to the Stuxnet and DuQu cyberattacks levelled at Iranian centrifuges by the United States in 2009-10.

"Stuxnet and Duqu belonged to a single chain of attacks, which raised cyberwar-related concerns worldwide," said Eugene Kaspersky, CEO and co-founder of Kaspersky Labs, in a statement on Flame. "The Flame malware looks to be another phase in this war, and it's important to understand that such cyber weapons can easily be used against any country."

Regular Windows users will be pleased to hear that since the Windows Update exploit was discovered, Microsoft has started working on ways to close the gap. Meanwhile, the Iranian Computer Emergency Response Team posted on its blog this week that it has developed software capable of detecting and removing Flame from infected devices. It said that this software was distributed to select organizations at the beginning of May.

While it's pleasing that security steps are ostensibly being taken to protect users from Flame, full comprehension of the malware may be a long way off. "It took us half a year to analyze Stuxnet," said Alexander Gostev, chief security expert at Kaspersky Lab. "This is 20 times more complicated. It will take us 10 years to fully understand everything."

Expect to hear more about this particular cyberweapon as more analysts dissect it and learn its secrets. In the meantime, enjoy having an excuse (however brief) for distrusting Windows Updater. Or was I the only one?

Hevva:Expect to hear more about this particular cyberweapon as more analysts dissect it and learn its secrets. In the meantime, enjoy having an excuse (however brief) for distrusting Windows Updater. Or was I the only one?

Right as I read this, my Windows "You have new updates" box popped up.

Le sigh.

Anyways, this is scary. I hope Microsoft removes the updater loophole quickly.

imnotparanoid:I will never be brave enough to use the internet again...

Basically, this. I'm damn near about to piss myself knowing that my machine can fucking catch it just by using Windows Update.

The fact that this thing can listen in on my Skype calls or my emails just makes me think "This is the PATRIOT Act all over again." As such, I'm slightly leaning toward the U.S. government having something to do with this. Also, it's been primarily infecting Middle Eastern systems. Coincidence? I think not.

We need to start punishing the people that actually do spy on us using stuff like this. For those of you who've already installed recent Windows updates, I recommend leaving some sort of vile, disgusting porn on that Yahtzee wouldn't even want to watch. Imagine, having to sit at a computer watching something like that for an entire work day. Make them pay for stuff like this >:D

You can more or less relax. This hasn't been targeted at you yet and cannot spoof WU unless you are already compromised by something else, in many affected system's cases an infected USB flash drive.

Microsoft has released an update to partially fix this problem, which may just be the update many of you saw "last night" or "while I was reading this". It's KB2718704. If you've got it, then you're probably OK until they come up with a more permanent solution.

TBH theres a lot of hyperbole in the OP. It has freaked out companies such as Kaspersky as they've only just been able to pick it up. And to those of you who don't do windows updates, don't be stupid as you generally are leaving more security gaps and exploits open for other attackers or malicious code to take advantage of and in fact that's one of the ways I think flame can spoof being an update, as the outdated update program's certificates (essentially confirmation that the program you're downloading is the one you've requested) may wrong or out of date.If you are scared about getting various baddies through a windows update I'm fairly sure windows has a database of the available updates, which may help you comb out some of the more obvious ones.

Oh my god people. This was a pretty obviously a successful attempt at spying on foreign governments. I really don't think they would waste the manpower to make a virus that complex to check up on your porn or gaming habits.

I read all windows update descriptions and chose what to install. yesterday a update poped up with "certificate unverifier" and along those lines and my thinking was "i dont want microsoft to have its say about what certificates i trust, to hell with it" and so i avoided the virus :D

I've always pretty much assumed that whatever email I write and whatever strange things I look for on a Google search--there is someone and probably multiple people that have access to it, if they were in a mind to read it.

For most of us, they are going to be searching for key words to send us the right advertisements. If other than that you mostly obey the law, nobody is going to care about what you write or what you say. Just be mindful around online banking.

the obvious defense against this is to just leave your computer on when you sleep, with lemonparty open on your browser. Full screen.

Imagine being the guy who would have to go through all 8-12 hours of that. If you open an IM in the background, that's 4x60x8= 1920 screenshots. They'd probably get to about 12 and skip to #200, skip to #1000, and then just quit their job.